A secure design case for browser-to-object-storage uploads with authorization, validation, isolation, and asynchronous processing.
Engineer’s take
Use direct object-storage upload patterns when large files should bypass application servers while remaining tightly scoped to an authorized operation.
Avoid giving clients broad bucket or storage permissions just to simplify upload handling.
Issue narrowly scoped upload authorization, validate content asynchronously, isolate untrusted objects, and record the upload lifecycle.
Direct uploads improve scalability but move validation, authorization boundaries, and lifecycle management into more explicit components.
Architecture
Let an authorized client upload directly to object storage while the application controls authorization and downstream processing.
Client → authorization API → scoped upload → object storage → validation → approved processing
Use short-lived scoped permissions, content validation, object isolation, encryption, and audit logging.
Direct uploads reduce application bandwidth pressure; account for storage, validation, scanning, and lifecycle costs.
Scale validation asynchronously and keep large payloads out of latency-sensitive application servers.
Unauthorized upload, malicious content, oversized files, partial uploads, validation failure, and orphaned objects.
Users need to upload potentially large and untrusted files without forcing the application server to proxy every byte.
Client → authorization API → scoped upload → object storage → validation → approved processing
The upload permission should be narrowly scoped to the intended operation. Treat uploaded content as untrusted until validation is complete.
Engineering companion
Knowledge path